Node.js Backend Development Bootcamp · 课时

速率限制与暴力破解防护

通过实现速率限制和暴力破解防护，保护您的 Node.js API 免受滥用、拒绝服务和凭据填充攻击

速率限制与暴力破解防护 是 CoddyKit 上的免费 Node.js Backend Development Bootcamp 课时。这是第 4 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Node.js Backend Development Bootcamp 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Node.js Backend Development Bootcamp 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Why Limit Requests?

Without limits, a single client can hammer your API thousands of times per second — scraping data, guessing passwords, or simply overloading the server.

Rate limiting caps how many requests a client may make in a time window.

Attacks Rate Limiting Prevents

Rate limiting is a frontline defense against:

Brute-force login attempts
Credential stuffing with leaked passwords
Denial-of-service floods
Scraping and API abuse

How Counting Works

A rate limiter tracks a counter per client (usually keyed by IP). Each request increments it; when the count exceeds the limit within the window, further requests are rejected with 429 Too Many Requests.

express-rate-limit

The express-rate-limit package adds rate limiting as middleware in a few lines. Configure the window and max requests.

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100
});

Applying the Limiter

Apply globally with app.use, or to specific routes. Once over the limit, clients automatically receive a 429 response.

app.use(limiter);
// or just protect one route:
app.use('/api/', limiter);

Stricter Limits on Login

const loginLimiter = rateLimit({
  windowMs: 10 * 60 * 1000,
  max: 5,
  message: 'Too many login attempts'
});
app.post('/login', loginLimiter, handler);

Shared Store for Multiple Servers

The default in-memory store does not work when you run multiple instances behind a load balancer — each has its own counter. Use a shared store like Redis so limits apply across all servers.

const RedisStore = require('rate-limit-redis');
const limiter = rateLimit({
  store: new RedisStore({ /* client */ }),
  max: 100,
  windowMs: 60000
});

Trusting the Real Client IP

Behind a proxy, every request appears to come from the proxy's IP. Tell Express to trust the proxy so the limiter keys on the real client IP from X-Forwarded-For.

app.set('trust proxy', 1);

Account Lockout

Beyond IP limits, track failed logins per account. After several failures, temporarily lock the account or require a CAPTCHA — defeating distributed brute-force from many IPs.

if (user.failedAttempts >= 5) {
  return res.status(423).json({ error: 'Account locked' });
}

Slowing Down Instead of Blocking

An alternative to hard blocks is progressive delay: each repeated request waits a little longer. The express-slow-down package adds latency rather than rejecting outright.

const slowDown = require('express-slow-down');
const speedLimiter = slowDown({
  windowMs: 60000,
  delayAfter: 50,
  delayMs: () => 500
});

Informing Clients

Good limiters send RateLimit headers telling clients their remaining quota and reset time, so well-behaved apps can back off gracefully.

const limiter = rateLimit({
  max: 100,
  windowMs: 60000,
  standardHeaders: true
});

Quick Check

Test your rate-limiting knowledge.

Recap

You learned to protect APIs from abuse:

Rate limiting caps requests per client and returns 429 when exceeded
express-rate-limit adds it as middleware; use stricter limits on login
Use a Redis store across multiple servers and set trust proxy for real IPs
Add account lockout, progressive slow-down, and informative headers

These layers thwart brute-force, scraping, and DoS attacks.

常见问题解答

「速率限制与暴力破解防护」课时是免费的吗？

是的 — 「速率限制与暴力破解防护」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Node.js Backend Development Bootcamp 课程的其余内容，请升级到 CoddyKit PRO。 Node.js Backend Development Bootcamp 课程共包含 4 节课。

「速率限制与暴力破解防护」这节课中我会学到什么？

通过实现速率限制和暴力破解防护，保护您的 Node.js API 免受滥用、拒绝服务和凭据填充攻击你通过在浏览器中直接运行的动手代码来练习 Node.js Backend Development Bootcamp，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Node.js Backend Development Bootcamp 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Node.js Backend Development Bootcamp 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 4 节课，共 4 节。

「速率限制与暴力破解防护」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Node.js Backend Development Bootcamp 课中编写并运行代码吗？

能。每节 Node.js Backend Development Bootcamp 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Node.js Backend Development Bootcamp